@bongos/core 1.19.184 → 1.19.185

package/docs/api-reference.md

@@ -214,19 +214,19 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/goals/inbox` | `any-builder` | — | GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112): { invitations: invites addressed to me (accept/decline); join… |
 | POST | `/api/bongos/goals/reorder` | `metic+archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
 
-## `governance` (9)
+## `government` (9)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/governance/assignments` | `archon` | — | governance.manage — every builder↔role assignment row. |
-| POST | `/api/bongos/governance/assignments` | `archon` | `builder_id`, `role_key` | governance.manage — assign a CUSTOM role to a builder. |
-| DELETE | `/api/bongos/governance/assignments/:builderId/:roleKey` | `archon` | — | governance.manage — remove a custom-role assignment. |
-| GET | `/api/bongos/governance/permissions` | `archon` | — | governance.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |
-| GET | `/api/bongos/governance/roles` | `archon` | — | governance.manage — the full role list with each role's grants. |
-| POST | `/api/bongos/governance/roles` | `archon` | `role_key`, `label`, `description` | governance.manage — create a CUSTOM role (is_system false, no seeded_rank — the seeded four exist only via governance_002). |
-| PUT | `/api/bongos/governance/roles/:roleKey/permissions/:permissionKey` | `archon` | — | governance.manage — grant one permission to a role (the toggle's ON half). |
-| DELETE | `/api/bongos/governance/roles/:roleKey/permissions/:permissionKey` | `archon` | — | governance.manage — revoke a grant (the toggle's OFF half). |
-| POST | `/api/bongos/governance/roles/:roleKey/reset` | `archon` | — | governance.manage — restore a SEEDED rank-role to its catalog default (ADR 0172). |
+| GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔role assignment row. |
+| POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM role to a builder. |
+| DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-role assignment. |
+| GET | `/api/bongos/government/permissions` | `archon` | — | government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |
+| GET | `/api/bongos/government/ranks` | `archon` | — | government.manage — the full role list with each role's grants. |
+| POST | `/api/bongos/government/ranks` | `archon` | `rank_key`, `label`, `description` | government.manage — create a CUSTOM role (is_system false, no seeded_rank — the seeded four exist only via governance_002). |
+| PUT | `/api/bongos/government/ranks/:rankKey/permissions/:permissionKey` | `archon` | — | government.manage — grant one permission to a role (the toggle's ON half). |
+| DELETE | `/api/bongos/government/ranks/:rankKey/permissions/:permissionKey` | `archon` | — | government.manage — revoke a grant (the toggle's OFF half). |
+| POST | `/api/bongos/government/ranks/:rankKey/reset` | `archon` | — | government.manage — restore a SEEDED rank-role to its catalog default (ADR 0172). |
 
 ## `grades` (1)
 

package/docs/canonical-permissions.md

@@ -60,7 +60,7 @@ forming the ordered claim-gate tier **`xenos` (1) < `thetes` (2) < `metic` (3) <
   RANK and IDENTITY, not day-to-day administration.** It is everything a Metic can do, plus: **rank**
   (grant/revoke — the single writer), **identity** (offboard/(de)activate, admit an access request, revoke
   sessions), the **four escalation keys** that would otherwise make that delegation self-reversible
-  (grader-bypass confirm, CI gate approval, protected-module goal scope, and `governance.manage`),
+  (grader-bypass confirm, CI gate approval, protected-module goal scope, and `government.manage`),
   **version close**, cross-tier dependency edges, and the substrate floors (push `main`, protected paths,
   ssh — ADR 0043). Version-**level** criteria (a `done-when` with no `goal_id`, or one outside an open
   version / outside a goal they own) also stay Archon per
@@ -140,7 +140,7 @@ or missing ranks fail closed.
     (who is admitted), `POST /api/gds/auth/revoke[-all]` (whose sessions are valid).
   - **the four escalation keys**, which look operational but are not: `POST /api/gds/tasks/:id/confirm`
     (grader-bypass), `POST /api/gds/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
-    **goal scope** ([ADR 0086](adr/<redacted>.md)), and `governance.manage` (the
+    **goal scope** ([ADR 0086](adr/<redacted>.md)), and `government.manage` (the
     roles/permissions tab). Delegating any one of them lets a Metic reach Archon in four steps — create a
     protected-scope goal in the permission core, claim a task there (protected paths already floor at
     *metic* per [ADR 0043](adr/<redacted>.md)), confirm
@@ -153,11 +153,11 @@ or missing ranks fail closed.
   > **Amended by [ADR 0172](adr/<redacted>.md) (owner decision, 2026-08-16).**
   > The paragraphs above describe the SEEDED ladder, which is still what a fresh instance boots with — but
   > they are no longer a guarantee about a running one. The owner made the three sub-Archon **rank roles**
-  > editable from the governance tab and chose to include the seven in-app Archon powers, `governance.manage`
+  > editable from the governance tab and chose to include the seven in-app Archon powers, `government.manage`
   > and `builder.rank.set` among them. So "no system permission is grantable below archon" now reads:
   > *no system permission is grantable to a CUSTOM role, and none is seeded below archon* — an Archon may
   > nonetheless hand one to a rank role deliberately. The four-step escalation chain described above is
-  > therefore **open by decision, not by accident**: whoever holds `governance.manage` can reach the rest.
+  > therefore **open by decision, not by accident**: whoever holds `government.manage` can reach the rest.
   > Two things that did NOT move, and that bound the blast radius: the **Archon** rank-role is immutable
   > (nothing clickable revokes the permission needed to reach the tab), and the three **substrate** keys stay
   > non-grantable to every role — ADR 0043's enforcers read the rank ladder and never consult this database,
@@ -192,9 +192,9 @@ or missing ranks fail closed.
 
   **[ADR 0157](adr/<redacted>.md) added the whole operational block here** —
   20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
-  the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.governance`) and
+  the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.government`) and
   `GET /api/gds/sessions/search` (whose own `/sessions` page had no server gate at all until
-  task 1002710 put it behind `page.view.governance` alongside its three group-mates); the
+  task 1002710 put it behind `page.view.government` alongside its three group-mates); the
   **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
   `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -337,25 +337,25 @@ function createClient(opts = {}) {
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
     },
-    "governance": {
-      // GET /governance/assignments — rank: archon — GET /governance/assignments
-      getGovernanceAssignments: (args) => request("GET", "/governance/assignments", { hasBody: false }, args),
-      // POST /governance/assignments — rank: archon — POST /governance/assignments
-      postGovernanceAssignments: (args) => request("POST", "/governance/assignments", { hasBody: true }, args),
-      // DELETE /governance/assignments/{builderId}/{roleKey} — rank: archon — DELETE /governance/assignments/:builderId/:roleKey
-      deleteGovernanceAssignmentsBuilderIdRoleKey: (args) => request("DELETE", "/governance/assignments/{builderId}/{roleKey}", { hasBody: false }, args),
-      // GET /governance/permissions — rank: archon — GET /governance/permissions
-      getGovernancePermissions: (args) => request("GET", "/governance/permissions", { hasBody: false }, args),
-      // GET /governance/roles — rank: archon — GET /governance/roles
-      getGovernanceRoles: (args) => request("GET", "/governance/roles", { hasBody: false }, args),
-      // POST /governance/roles — rank: archon — POST /governance/roles
-      postGovernanceRoles: (args) => request("POST", "/governance/roles", { hasBody: true }, args),
-      // DELETE /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — DELETE /governance/roles/:roleKey/permissions/:permissionKey
-      deleteGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("DELETE", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: false }, args),
-      // PUT /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — PUT /governance/roles/:roleKey/permissions/:permissionKey
-      putGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("PUT", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: true }, args),
-      // POST /governance/roles/{roleKey}/reset — rank: archon — POST /governance/roles/:roleKey/reset
-      postGovernanceRolesRoleKeyReset: (args) => request("POST", "/governance/roles/{roleKey}/reset", { hasBody: true }, args),
+    "government": {
+      // GET /government/assignments — rank: archon — GET /government/assignments
+      getGovernmentAssignments: (args) => request("GET", "/government/assignments", { hasBody: false }, args),
+      // POST /government/assignments — rank: archon — POST /government/assignments
+      postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
+      // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
+      deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/permissions — rank: archon — GET /government/permissions
+      getGovernmentPermissions: (args) => request("GET", "/government/permissions", { hasBody: false }, args),
+      // GET /government/ranks — rank: archon — GET /government/ranks
+      getGovernmentRanks: (args) => request("GET", "/government/ranks", { hasBody: false }, args),
+      // POST /government/ranks — rank: archon — POST /government/ranks
+      postGovernmentRanks: (args) => request("POST", "/government/ranks", { hasBody: true }, args),
+      // DELETE /government/ranks/{rankKey}/permissions/{permissionKey} — rank: archon — DELETE /government/ranks/:rankKey/permissions/:permissionKey
+      deleteGovernmentRanksRankKeyPermissionsPermissionKey: (args) => request("DELETE", "/government/ranks/{rankKey}/permissions/{permissionKey}", { hasBody: false }, args),
+      // PUT /government/ranks/{rankKey}/permissions/{permissionKey} — rank: archon — PUT /government/ranks/:rankKey/permissions/:permissionKey
+      putGovernmentRanksRankKeyPermissionsPermissionKey: (args) => request("PUT", "/government/ranks/{rankKey}/permissions/{permissionKey}", { hasBody: true }, args),
+      // POST /government/ranks/{rankKey}/reset — rank: archon — POST /government/ranks/:rankKey/reset
+      postGovernmentRanksRankKeyReset: (args) => request("POST", "/government/ranks/{rankKey}/reset", { hasBody: true }, args),
     },
     "grades": {
       // GET /grades/by-builder — rank: metic+archon — GET /grades/by-builder

package/modules/government/catalog.js

@@ -104,7 +104,7 @@ const PERMISSIONS = [
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },
-  { key: 'governance.manage', system: true, floor: 'archon', guards: 'the governance tab routes (roles/perms/assignments CRUD, reads included — R110) — meta-escalation' },
+  { key: 'government.manage', system: true, floor: 'archon', guards: 'the governance tab routes (roles/perms/assignments CRUD, reads included — R110) — meta-escalation' },
   { key: 'gate_approval.decide', system: true, floor: 'archon', guards: 'POST /gate-approvals/:pr/approve — CI deploy-gate override' },
   { key: 'deploy.push_main', system: true, substrate: true, floor: 'archon', guards: 'git push origin main / the deploy — substrate-enforced (pre-push, main-audit)' },
   { key: 'path.protected.modify', system: true, substrate: true, floor: 'archon', guards: 'modifying a PROTECTED_GLOBS path below the Metic floor — substrate (ADR 0043)' },
@@ -123,7 +123,7 @@ const PERMISSIONS = [
   //
   // The four trust-boundary keys that ALSO stay Archon are system:true above
   // (`task.confirm.grade_bypass`, `gate_approval.decide`, `goal.scope.manage`,
-  // `governance.manage`) — see the ADR's escalation-chain argument for why moving any
+  // `government.manage`) — see the ADR's escalation-chain argument for why moving any
   // one of them would make this delegation self-reversible.
   { key: 'builder.status.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/status — offboard / (de)activate' },
   { key: 'auth.session.revoke', system: false, floor: 'archon', guards: 'POST /auth/revoke, /auth/revoke-all' },
@@ -207,7 +207,7 @@ const PERMISSIONS = [
   { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
   // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
   // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
-  // Metic could reach /gate via `page.view.governance` and then 403 on its only data
+  // Metic could reach /gate via `page.view.government` and then 403 on its only data
   // endpoint — a page that renders nothing but an error.
   { key: 'gate_approval.read', system: false, floor: 'metic', guards: 'GET /gate-approvals — the Gate page read side (approve = gate_approval.decide, archon)' },
 
@@ -236,9 +236,9 @@ const PERMISSIONS = [
   // ADR 0157: floor archon→metic, which is what opens /watch, /harbor and /gate to the
   // working rank. The gate FUNCTION was renamed to match (`requireArchonPage` →
   // `requireGovernancePage`) once the floor moved. Viewing is all this grants: every
-  // write those pages reach is its own atom, and `governance.manage` (the
+  // write those pages reach is its own atom, and `government.manage` (the
   // roles/permissions tab) stayed archon.
-  { key: 'page.view.governance', system: false, floor: 'metic', guards: 'the governance/monitoring pages — /watch, /harbor, /gate (requireGovernancePage; write = governance.manage, archon)' },
+  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the governance/monitoring pages — /watch, /harbor, /gate (requireGovernancePage; write = government.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────
@@ -418,13 +418,13 @@ function substrateKeys() {
 //     success and delegate nothing. Refusing them keeps the tab honest.
 //   • the ARCHON rank-role — nothing. It is immutable and already holds everything,
 //     and that immutability is also the LOCKOUT GUARD: the only role carrying
-//     `governance.manage` by seed can never have it revoked, so no sequence of
+//     `government.manage` by seed can never have it revoked, so no sequence of
 //     clicks in this tab can lock the owner out of the tab.
 //   • a SEEDED rank-role BELOW archon — everything else, the seven in-app Archon
 //     powers included. This is the delegation lever the owner asked for.
 //   • a CUSTOM role — operational only: the pre-existing R110 wall, deliberately NOT
 //     widened. A rank-role is the owner's own coarse ladder, moved by a rank write;
-//     a custom role is ad-hoc and assignable by anyone holding `governance.manage`,
+//     a custom role is ad-hoc and assignable by anyone holding `government.manage`,
 //     so widening it would hand the second group the first group's lever.
 //
 // Fail-closed on everything unrecognised: unknown key, missing role, or a system role

package/modules/government/db.js

@@ -32,10 +32,10 @@ async function getPermissionKeysForBuilder(builderId) {
 // R110/R111) and for explaining a 403. Not part of the resolve path.
 async function getRoleKeysForBuilder(builderId) {
   const { rows } = await pool.query(
-    `SELECT rank_key AS role_key FROM government_builder_ranks WHERE builder_id = $1 ORDER BY rank_key`,
+    `SELECT rank_key FROM government_builder_ranks WHERE builder_id = $1 ORDER BY rank_key`,
     [builderId],
   );
-  return rows.map((r) => r.role_key);
+  return rows.map((r) => r.rank_key);
 }
 
 // --- the rank→role WRITE half (BV1.R95b) ------------------------------------
@@ -57,7 +57,7 @@ async function getRoleKeysForBuilder(builderId) {
 // runs on rank writes + sign-in, never in a hot loop.
 async function getSeededRankRoles(q) {
   const { rows } = await q.query(
-    `SELECT rank_key AS role_key, seeded_rank, is_system
+    `SELECT rank_key, seeded_rank, is_system
        FROM government_ranks
       WHERE is_system = true AND seeded_rank IS NOT NULL`,
   );
@@ -68,7 +68,7 @@ async function getSeededRankRoles(q) {
 // seeded rank-role from an Archon-assigned custom one.
 async function getRoleAssignmentsForBuilder(q, builderId) {
   const { rows } = await q.query(
-    `SELECT br.rank_key AS role_key, r.is_system, r.seeded_rank
+    `SELECT br.rank_key, r.is_system, r.seeded_rank
        FROM government_builder_ranks br
        JOIN government_ranks r ON r.rank_key = br.rank_key
       WHERE br.builder_id = $1`,
@@ -127,7 +127,7 @@ async function syncRank(client, { builderId, rank } = {}) {
 
 async function listRolesWithGrants() {
   const { rows } = await pool.query(
-    `SELECT r.rank_key AS role_key, r.label, r.description, r.is_system, r.seeded_rank,
+    `SELECT r.rank_key, r.label, r.description, r.is_system, r.seeded_rank,
             r.created_by, r.created_at,
             COALESCE(array_agg(rp.permission_key ORDER BY rp.permission_key)
                      FILTER (WHERE rp.permission_key IS NOT NULL), '{}') AS permissions
@@ -141,7 +141,7 @@ async function listRolesWithGrants() {
 
 async function getRoleByKey(roleKey) {
   const { rows } = await pool.query(
-    `SELECT rank_key AS role_key, label, description, is_system, seeded_rank, created_by, created_at
+    `SELECT rank_key, label, description, is_system, seeded_rank, created_by, created_at
        FROM government_ranks
       WHERE rank_key = $1`,
     [roleKey],
@@ -153,7 +153,7 @@ async function createRole({ roleKey, label, description, createdBy }) {
   const { rows } = await pool.query(
     `INSERT INTO government_ranks (rank_key, label, description, is_system, seeded_rank, created_by)
      VALUES ($1, $2, $3, false, NULL, $4)
-     RETURNING rank_key AS role_key, label, description, is_system, seeded_rank, created_by, created_at`,
+     RETURNING rank_key, label, description, is_system, seeded_rank, created_by, created_at`,
     [roleKey, label, description ?? null, createdBy],
   );
   return rows[0];
@@ -210,7 +210,7 @@ async function resetRoleGrants({ roleKey, permissionKeys }) {
 async function listAssignments() {
   const { rows } = await pool.query(
     `SELECT br.builder_id, b.github_login, b.display_name, b.rank,
-            br.rank_key AS role_key, r.label AS role_label, r.is_system, r.seeded_rank,
+            br.rank_key, r.label AS role_label, r.is_system, r.seeded_rank,
             br.assigned_by, br.assigned_at
        FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id

package/modules/government/migrations/government_002_rename_permission_keys.sql

@@ -0,0 +1,112 @@
+-- government_002_rename_permission_keys.sql
+-- Goal 1000068 R05 (task 1003006) — ADR 0174.
+--
+-- Renames the two permission KEYS that still carried the old vocabulary, in the
+-- grant rows that hold them:
+--
+--   governance.manage     -> government.manage
+--   page.view.governance  -> page.view.government
+--
+-- These are DATA, not schema: `government_rank_permissions.permission_key` is
+-- free text validated app-side against the code catalog (it is deliberately not
+-- a foreign key — the catalog is CODE, not a table; see governance_001).
+--
+-- ── WHY THIS IS SEPARATE FROM government_001 ────────────────────────────────
+-- 001 renamed the tables and pairs with the code that QUERIES them. This one
+-- pairs with `modules/government/catalog.js`, which declares the key strings,
+-- and it must land in the SAME release as that edit. The coupling is sharper
+-- than it looks: `resolver.js` DROPS any grant naming a key the catalog does not
+-- define (the fail-closed rule). So if these rows were renamed while the catalog
+-- still said `governance.manage`, every renamed grant would resolve to nothing —
+-- and because that key is what gates the Government tab, the owner would be
+-- locked out of the very surface used to diagnose it. The inverse is equally
+-- true: shipping the catalog edit without this migration leaves the live rows
+-- naming keys the catalog no longer defines, with the same result.
+--
+-- Both halves are in this commit, and the live instance's auto-upgrade sweep
+-- stays paused (task 1003011) until the whole rename is released together.
+--
+-- ── ROW-COUNT SAFETY ────────────────────────────────────────────────────────
+-- These are PRIMARY KEY columns (rank_key, permission_key). A rank that somehow
+-- held BOTH the old and the new key would collide on UPDATE, so the update is
+-- written to skip any row whose target already exists, and the assertion at the
+-- end proves the old keys are gone and the new counts match what was there
+-- before. Live baseline captured 2026-08-16 before the rename:
+--   governance.manage      -> 1 grant  (the archon rank only)
+--   page.view.governance   -> 2 grants (metic + archon)
+--
+-- IDEMPOTENT: re-running finds no old keys and changes nothing.
+--
+-- ROLLBACK: reverse the two UPDATEs (new key -> old key). Lossless.
+--   UPDATE government_rank_permissions SET permission_key = 'governance.manage'
+--    WHERE permission_key = 'government.manage';
+--   UPDATE government_rank_permissions SET permission_key = 'page.view.governance'
+--    WHERE permission_key = 'page.view.government';
+
+BEGIN;
+
+-- Capture the before-counts so the assertion below can prove nothing was lost.
+CREATE TEMP TABLE _govt_key_rename_before ON COMMIT DROP AS
+SELECT
+  count(*) FILTER (WHERE permission_key = 'governance.manage')    AS old_manage,
+  count(*) FILTER (WHERE permission_key = 'page.view.governance') AS old_page,
+  count(*) FILTER (WHERE permission_key = 'government.manage')    AS new_manage,
+  count(*) FILTER (WHERE permission_key = 'page.view.government') AS new_page
+FROM government_rank_permissions;
+
+UPDATE government_rank_permissions g
+   SET permission_key = 'government.manage'
+ WHERE g.permission_key = 'governance.manage'
+   AND NOT EXISTS (
+     SELECT 1 FROM government_rank_permissions x
+      WHERE x.rank_key = g.rank_key AND x.permission_key = 'government.manage');
+
+UPDATE government_rank_permissions g
+   SET permission_key = 'page.view.government'
+ WHERE g.permission_key = 'page.view.governance'
+   AND NOT EXISTS (
+     SELECT 1 FROM government_rank_permissions x
+      WHERE x.rank_key = g.rank_key AND x.permission_key = 'page.view.government');
+
+-- Any row the collision guard skipped would be a duplicate grant; drop it so the
+-- old key cannot survive. (Expected to affect zero rows — a rank holding both
+-- spellings should not exist. Written so the assertion below can be absolute.)
+DELETE FROM government_rank_permissions
+ WHERE permission_key IN ('governance.manage', 'page.view.governance');
+
+DO $$
+DECLARE
+  b record;
+  a_manage int;
+  a_page   int;
+  leftover int;
+BEGIN
+  SELECT * INTO b FROM _govt_key_rename_before;
+  SELECT count(*) INTO a_manage FROM government_rank_permissions WHERE permission_key = 'government.manage';
+  SELECT count(*) INTO a_page   FROM government_rank_permissions WHERE permission_key = 'page.view.government';
+  SELECT count(*) INTO leftover FROM government_rank_permissions
+    WHERE permission_key IN ('governance.manage', 'page.view.governance');
+
+  IF leftover <> 0 THEN
+    RAISE EXCEPTION 'government key rename: % row(s) still carry an old key — rolling back.', leftover;
+  END IF;
+
+  -- Every grant that existed under either spelling must exist under the new one.
+  IF a_manage <> GREATEST(b.old_manage, b.new_manage) THEN
+    RAISE EXCEPTION 'government.manage grant count is % but % was expected (before: old=%, new=%) — rolling back.',
+      a_manage, GREATEST(b.old_manage, b.new_manage), b.old_manage, b.new_manage;
+  END IF;
+  IF a_page <> GREATEST(b.old_page, b.new_page) THEN
+    RAISE EXCEPTION 'page.view.government grant count is % but % was expected (before: old=%, new=%) — rolling back.',
+      a_page, GREATEST(b.old_page, b.new_page), b.old_page, b.new_page;
+  END IF;
+
+  -- The lockout guard: SOMEONE must still hold the key that opens this tab.
+  IF a_manage = 0 THEN
+    RAISE EXCEPTION 'no rank holds government.manage after the rename — that is a lockout. Rolling back.';
+  END IF;
+
+  RAISE NOTICE 'government key rename OK: government.manage=% page.view.government=%', a_manage, a_page;
+END $$;
+
+COMMIT;

package/modules/government/module.json

@@ -10,7 +10,7 @@
   "contributes": {
     "migrations": true,
     "routes": [
-      "governance",
+      "government",
       "rank-sync"
     ]
   },

package/modules/government/protected-surfaces.json

@@ -34,7 +34,6 @@
     { "glob": "modules/lifecycle/routes/", "group": "authz", "why": "BV1.R86: the lifecycle routes carved out of src/bongos/routes/ — the gates follow the routes" },
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
-    { "glob": "modules/governance/", "group": "authz", "why": "the PRE-ADR-0174 path of the authz core. The folder itself moved to modules/government/ in goal 1000068 R03/R04, so nothing matches this glob in the core tree any more — it is kept for the one-release compatibility window because an in-flight branch or a vendored instance checkout may still carry the old path, and a protected path that silently stops being protected mid-rename is the failure this whole sequence exists to avoid. Dropped by R05 (task 1003006) with the rest of the compatibility surface." },
     { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/governance/ entry directly above (ADR 0086 §4)." },
     { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
     { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },

package/modules/government/ranks.js

@@ -42,32 +42,32 @@ function isSeededRank(row) {
     && row.seeded_rank.length > 0;
 }
 
-// planRankSync({ rank, currentRoles, seededRoles }) → { target, add, remove, next }
+// planRankSync({ rank, currentRanks, seededRanks }) → { target, add, remove, next }
 //
 //   rank         the builder's rank AFTER the write being synced.
-//   currentRoles the builder's assignments, each { role_key, is_system, seeded_rank }.
-//   seededRoles  the seeded rank-roles the DB defines, each { role_key, seeded_rank,
+//   currentRanks the builder's assignments, each { rank_key, is_system, seeded_rank }.
+//   seededRanks  the seeded rank-roles the DB defines, each { rank_key, seeded_rank,
 //                is_system }. Passed in rather than hardcoded so the four role keys
 //                stay DB truth — this file never re-declares the seed.
 //
-//   target  the seeded role_key the builder should end up with, or null when the
+//   target  the seeded rank_key the builder should end up with, or null when the
 //           rank has no seeded role (fail-closed divergence, above).
 //   add     [] or [target] — empty when it is already held (idempotence).
 //   remove  every OTHER seeded rank-role currently held. Custom roles never appear.
-//   next    the resulting role_key set, sorted — "what the role set becomes".
-function planRankSync({ rank, currentRoles = [], seededRoles = [] } = {}) {
-  const match = seededRoles.find((r) => isSeededRank(r) && r.seeded_rank === rank);
-  const target = match ? match.role_key : null;
+//   next    the resulting rank_key set, sorted — "what the role set becomes".
+function planRankSync({ rank, currentRanks = [], seededRanks = [] } = {}) {
+  const match = seededRanks.find((r) => isSeededRank(r) && r.seeded_rank === rank);
+  const target = match ? match.rank_key : null;
 
-  const held = currentRoles.filter((r) => r && typeof r.role_key === 'string');
+  const held = currentRanks.filter((r) => r && typeof r.rank_key === 'string');
   const remove = held
-    .filter((r) => isSeededRank(r) && r.role_key !== target)
-    .map((r) => r.role_key);
-  const add = target && !held.some((r) => r.role_key === target) ? [target] : [];
+    .filter((r) => isSeededRank(r) && r.rank_key !== target)
+    .map((r) => r.rank_key);
+  const add = target && !held.some((r) => r.rank_key === target) ? [target] : [];
 
   const removed = new Set(remove);
   const next = held
-    .map((r) => r.role_key)
+    .map((r) => r.rank_key)
     .filter((key) => !removed.has(key))
     .concat(add)
     .sort();